Core AWS Concepts Interviewers Test
A very common opening question is 'what's the difference between EC2 and Lambda, and when would you use each?' Interviewers are not looking for a dictionary definition — they want you to reason about trade-offs: EC2 gives you a persistent, always-on server you fully control, suited to long-running processes or workloads needing consistent low-latency access to local state, while Lambda runs stateless functions triggered by events, scales to zero when idle, and suits unpredictable or bursty workloads where you don't want to pay for idle capacity. A related question, 'what's the difference between a Region and an Availability Zone,' tests whether you understand that a Region (e.g., us-east-1) is a geographic area containing multiple isolated Availability Zones, each its own physically separate data center, and that spreading resources across AZs (not just Regions) is what actually protects against a single data center failure.
Cricket analogy: EC2 is like a permanent home ground a team owns and maintains year-round, while Lambda is like renting a neutral venue only for specific matches — you pay only when there's a game, not for empty stadium upkeep between fixtures.
IAM and Security Questions
A frequent question is 'what's the difference between an IAM role and an IAM user?' A strong answer explains that an IAM user represents a long-term identity (a person or service) with permanent credentials, while an IAM role has no permanent credentials at all — it's assumed temporarily by a user, an AWS service like EC2 or Lambda, or an external identity, and grants short-lived, automatically rotating credentials for the duration of that session. Interviewers often follow up with 'how does IAM policy evaluation work,' testing whether you know that an explicit Deny always overrides an Allow anywhere in the evaluation, that by default everything is denied unless a policy explicitly allows it, and that the final decision considers identity-based policies, resource-based policies, permissions boundaries, and Service Control Policies together.
Cricket analogy: An IAM user is like a permanent squad member with a season-long contract, while an IAM role is like a substitute fielder brought on only for the current session and released once play stops — no lingering credentials after the match.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowS3ReadOnlyFromOneBucket",
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:ListBucket"],
"Resource": [
"arn:aws:s3:::interview-prep-bucket",
"arn:aws:s3:::interview-prep-bucket/*"
]
},
{
"Sid": "ExplicitDenyDeleteAnywhere",
"Effect": "Deny",
"Action": "s3:DeleteObject",
"Resource": "*"
}
]
}Networking and VPC Questions
Interviewers commonly ask 'what's the difference between a public subnet and a private subnet?' The correct answer hinges on routing, not naming: a subnet is 'public' only because its route table sends 0.0.0.0/0 traffic to an Internet Gateway, and 'private' because its route table instead sends outbound traffic through a NAT Gateway (or has no internet route at all). A strong candidate also explains the difference between an Internet Gateway and a NAT Gateway: an Internet Gateway allows both inbound and outbound internet traffic for resources with public IPs, while a NAT Gateway sits in a public subnet and allows resources in a private subnet to initiate outbound connections (like pulling software updates) without ever being reachable from the internet.
Cricket analogy: A public subnet is like a ground with an open turnstile letting spectators walk in directly (Internet Gateway), while a private subnet is like the players' area reachable only through a single monitored tunnel (NAT Gateway) that lets players go out but not fans in.
Scenario-Based and Behavioral Questions
Senior interviews often shift from definitions to open-ended design questions like 'design a scalable web application on AWS' or 'how would you reduce this architecture's cost by 30% without hurting reliability.' These are deliberately ambiguous — interviewers want to see you ask clarifying questions about traffic patterns and budget before diving into a solution, then reason out loud through trade-offs (e.g., Auto Scaling group versus Fargate, RDS versus DynamoDB) rather than jumping straight to a memorized 'correct' diagram. Behavioral questions ('tell me about a time a production deployment went wrong') are best answered with the STAR method — Situation, Task, Action, Result — grounding the story in a specific incident with a concrete, measurable outcome rather than a vague generality.
Cricket analogy: A scenario question is like a captain being asked to set a field for an unknown batsman — you'd first ask about their known scoring zones before committing to a plan, rather than copying a generic field setting.
The single best preparation for AWS interviews is hands-on practice within the AWS Free Tier: actually launching an EC2 instance, attaching an IAM role, configuring a VPC with public and private subnets, and breaking things on purpose to see the error messages. Interviewers can usually tell within a few follow-up questions whether an answer comes from real practice or from memorized documentation.
A common mistake is memorizing service feature lists without understanding the underlying trade-offs — for example, being able to recite that 'DynamoDB is fast and scalable' but unable to explain why a relational join-heavy reporting workload would actually be a poor fit for it. Interviewers probe follow-up questions specifically to catch surface-level memorization.
- EC2 vs Lambda questions test your understanding of always-on control versus event-driven, scale-to-zero compute.
- Region vs Availability Zone questions test whether you know AZs, not just Regions, are what protect against a single data center failure.
- IAM role vs IAM user hinges on permanent credentials (user) versus temporary, assumed credentials (role).
- IAM policy evaluation always applies an explicit Deny over any Allow, with implicit deny as the default.
- Public vs private subnet is determined by the route table's target (Internet Gateway vs NAT Gateway), not naming.
- Scenario-based design questions reward asking clarifying questions and reasoning about trade-offs over reciting a fixed diagram.
- Behavioral questions are best answered with the STAR method, grounded in a specific, measurable incident.
Practice what you learned
1. What ultimately determines whether an AWS subnet is 'public' or 'private'?
2. In IAM policy evaluation, what happens when one policy allows an action and another explicitly denies the same action?
3. What is the key functional difference between an IAM role and an IAM user?
4. What does the STAR method help structure in an interview answer?
Was this page helpful?
You May Also Like
The AWS Well-Architected Framework
A structured overview of the six pillars AWS uses to evaluate cloud architectures, and the practical trade-offs engineers face applying them.
AWS Quick Reference
A condensed cheat sheet of core AWS compute, storage, networking, database, IAM, and CLI facts for fast lookup and last-minute review.
Deploying a Simple App on AWS
A practical walkthrough of the main paths for getting a small web application live on AWS, from Elastic Beanstalk to static hosting with S3 and CloudFront.